Operation Endgame disrupts Gootloader, CastleRAT and StealC infrastructure
Operation Endgame reported action against 235 servers and 257 domains and identified roughly 6.4 million victim datasets on criminal infrastructure. CastleRAT victims can check Have I Been Pwned for exposed email addresses.
- Disclosed
- Nov 12, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Operators of compromised websites and people or organizations whose computers ran Gootloader, CastleRAT or StealC.
- Gootloader · CastleRAT · StealC · malware
- In the wild
- Yes
- Authorities confirmed malware infections and associated ransomware cases.
What happened
Gootloader used compromised sites, including WordPress sites, to lure visitors into downloading files presented as legal documents. Criminals sold access to infected machines, which could then be used for ransomware. CastleRAT gave operators remote control of infected computers. StealC collected passwords and other stored account data. The November action continued separate work against StealC that had already started in June.
The 6.4 million figure counts victim datasets identified across the November action. Have I Been Pwned lists 179,745 accounts for CastleRAT and added about 893,000 distinct passwords to the separate Pwned Passwords service. The US Justice Department separately estimates that Gootloader infected at least 25,000 computers worldwide since 2018 and was used in ransomware attacks affecting at least 44 US victims, with approximately $28.8 million in losses. These counts cover different populations and periods. Investigate and remediate affected systems even after the infrastructure disruption.
Crime-scene timeline
Nov 12, 2026
Operation Endgame announces a new round of infrastructure disruption
The action targets Gootloader distribution, CastleRAT infrastructure and StealC servers. Partners are helping notify victims and remediate affected systems.
Nov 12, 2026
US Justice Department reports its Gootloader operation
The department reports removing the malware from more than 100 servers and seizing US domains used to deliver or control it.
Nov 13, 05:41 UTC
Have I Been Pwned adds CastleRAT data
The service lists email addresses tied to infections and makes about 893,000 distinct passwords searchable separately through Pwned Passwords.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Operation Endgame announcementPrimaryGives the scope of the November action, recovered records, victim-notification channels and WordPress guidance.
- US Justice Department Gootloader announcementPrimaryDescribes US action against Gootloader and estimates its historical impact.
- Have I Been Pwned breach indexPrimaryLists 179,745 CastleRAT accounts and names email addresses and passwords as affected data.